1. I navigated to HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\GPExtension\\{827...\} and Added Value name ExtensionDebugLevel as a type REG_DWORD, setting it to 2. This turned on logging for Winlogon.

3. After inspecting Winlogon.log, I discovered that someone at Microsoft failed to learn the basics of database design, and did not implement referential integrity.

I had recently uninstalled IIS on my Windows 2000 Server. The initial install created the IUSR_... and IWAM_... accounts and assigned users rights. The uninstall removed these accounts, but failed to remove them from User Rights Assignment.

The fix was to manually remove the accounts from the from User Rights Assignment at Administrative Tools / Local Security Policy / Local Policies.